Performs proactive threat hunting in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline to identify threats evading automatic detection. For SOC teams targeting ATT&CK techniques, anomalies, or detection gaps.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
以下情况使用本技能：
Performs proactive threat hunting in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline to identify threats evading automated detection.
Performs proactive threat hunting in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline to identify threats evading automated detection. For SOC teams hunting ATT&CK techniques or detection gaps.
Hunts advanced persistent threats (APTs) in enterprises using hypothesis-based searches across EDR telemetry, Zeek network logs, and memory artifacts with Velociraptor/osquery. For periodic hunting cycles, UEBA anomaly investigations, and TTP verification.
Share bugs, ideas, or general feedback.
以下情况使用本技能：
不适用于实时告警分类——该场景应使用 Elastic Security 告警队列配合自动检测规则。
kibana_security_solution 和相关索引的 read 访问权限基于威胁情报、ATT&CK 技术或异常现象制定假设：
假设示例："攻击者正在使用离地攻击（LOLBins）执行操作，具体是使用 certutil.exe 进行文件下载（T1105 — 工具传输入侵）。"
定义范围：
logs-endpoint.events.process-*、logs-windows.sysmon_operational-*-urlcache、-split 或 -decode 标志的 certutil.exe打开 Kibana Discover 并使用 KQL（Kibana 查询语言）进行查询：
process.name: "certutil.exe" and process.args: ("-urlcache" or "-split" or "-decode" or "-encode" or "-verifyctl")
排除已知合法用途进行精炼：
process.name: "certutil.exe"
and process.args: ("-urlcache" or "-split" or "-decode")
and not process.parent.name: ("sccm*.exe" or "ccmexec.exe")
and not user.name: "SYSTEM"
使用编码命令进行 PowerShell 狩猎（T1059.001）：
process.name: "powershell.exe"
and process.args: ("-enc" or "-encodedcommand" or "-e " or "frombase64string" or "iex" or "invoke-expression")
and not process.parent.executable: "C:\\Windows\\System32\\svchost.exe"
Elastic 事件查询语言（EQL）支持狩猎多步骤攻击序列：
检测父子进程异常（T1055 — 进程注入）：
sequence by host.name with maxspan=5m
[process where event.type == "start" and process.name == "explorer.exe"]
[process where event.type == "start" and process.parent.name == "explorer.exe"
and process.name in ("cmd.exe", "powershell.exe", "rundll32.exe", "regsvr32.exe")]
检测凭据转储序列（T1003）：
sequence by host.name with maxspan=2m
[process where event.type == "start"
and process.name in ("procdump.exe", "procdump64.exe", "rundll32.exe", "taskmgr.exe")
and process.args : "*lsass*"]
[file where event.type == "creation"
and file.extension in ("dmp", "dump", "bin")]
检测通过 PsExec 进行横向移动（T1021.002）：
sequence by source.ip with maxspan=1m
[authentication where event.outcome == "success" and winlog.logon.type == "Network"]
[process where event.type == "start"
and process.name == "psexesvc.exe"]
在 Elastic Security 中创建 Timeline 调查以进行协作分析：
host.name: "WORKSTATION-042" and event.category: ("process" or "network" or "file")
添加关键字段列：@timestamp、event.action、process.name、process.args、user.name、source.ip、destination.ip
将成功的狩猎查询转换为 Elastic 检测规则：
{
"name": "Certutil 下载活动",
"description": "检测用于文件下载的 certutil.exe，一种常见的 LOLBin 技术",
"risk_score": 73,
"severity": "high",
"type": "eql",
"query": "process where event.type == \"start\" and process.name == \"certutil.exe\" and process.args : (\"-urlcache\", \"-split\", \"-decode\") and not process.parent.name : (\"ccmexec.exe\", \"sccm*.exe\")",
"threat": [
{
"framework": "MITRE ATT&CK",
"tactic": {
"id": "TA0011",
"name": "Command and Control"
},
"technique": [
{
"id": "T1105",
"name": "Ingress Tool Transfer"
}
]
}
],
"tags": ["Hunting", "LOLBins", "T1105"],
"interval": "5m",
"from": "now-6m",
"enabled": true
}
通过 Elastic Security API 部署：
curl -X POST "https://kibana:5601/api/detection_engine/rules" \
-H "kbn-xsrf: true" \
-H "Content-Type: application/json" \
-H "Authorization: ApiKey YOUR_API_KEY" \
-d @certutil_rule.json
使用聚合创建狩猎仪表板：
GET logs-endpoint.events.process-*/_search
{
"size": 0,
"query": {
"bool": {
"must": [
{"term": {"process.name": "certutil.exe"}},
{"range": {"@timestamp": {"gte": "now-30d"}}}
]
}
},
"aggs": {
"by_host": {
"terms": {"field": "host.name", "size": 20},
"aggs": {
"by_user": {
"terms": {"field": "user.name", "size": 10}
},
"by_args": {
"terms": {"field": "process.args", "size": 10}
}
}
}
}
}
在结构化狩猎报告中记录发现结果并更新检测覆盖率：
| 术语 | 定义 |
|---|---|
| KQL | Kibana 查询语言——用于在 Kibana Discover 和仪表板中过滤数据的简化查询语法 |
| EQL | 事件查询语言——Elastic 的序列感知查询语言，用于检测多步骤攻击模式 |
| ECS | Elastic 通用模式——标准化字段命名规范，支持跨数据源关联 |
| Timeline | Elastic Security 调查工作区，用于协作事件分析和注释 |
| 假设驱动狩猎 | 从攻击者行为理论出发，针对遥测数据进行测试的结构化方法 |
| LOLBins | 离地二进制（Living Off the Land Binaries）——被攻击者滥用的合法 Windows 工具（certutil、mshta、rundll32） |
威胁狩猎报告 — TH-2024-012
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
假设： 攻击者使用 certutil.exe 进行工具下载（T1105）
时间段： 2024-02-15 至 2024-03-15
数据源： Elastic Endpoint（进程事件）、Sysmon
发现结果：
certutil 执行总次数： 342
带 -urlcache 标志： 12（3.5%）
可疑（非 SCCM）： 3 个已确认异常
受影响主机：
WORKSTATION-042（财务） — certutil 从外部 IP 下载 payload.exe
SERVER-DB-03（数据库） — certutil 解码 base64 编码二进制文件
LAPTOP-EXEC-07（高管） — certutil 从 Pastebin 下载脚本
已采取行动：
[完成] 3 台主机已隔离进行取证调查
[完成] 检测规则"Certutil 下载活动"已部署（ID: elastic-th012）
[完成] ATT&CK Navigator 已更新：T1105 覆盖率 = 绿色
结论： 假设已确认——3 个真阳性发现已上报 IR